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Amendments to the Claims: 

This listing of claims will replace all prior versions, and listings, of claims in the application: 
Listing of Claims: 

1. (Currently Amended) A network processing system for use in a network, the network 
passing a plurality of data packets, which form a plurality of flows, the network processing 
system comprising: 

a network interface operable to receive data packets from the network and further operable to 
send processed data packets back onto the network; and 

a learning state machine in communication with the network interface, the learning state 
machine operable to learn and maintain state for particular flows based on content of respective 
flows, wherein the leaming state machine assigns an identifier to one or more of the particular flows 
and associates each data packet belonging to that flow with the identifier, the leaming state machine 
fiirther operable to identify characteristics of one or more of the particular flows and to store those 
characteristics in a state database in the leaming state machine such that the network processing 
system is able to treat the data packets based on the state of the associated flow. 

2. (Original) The network processing system of Claim 1 further comprising a second 
leaming state machine, wherein each leaming state machine is unidirectional in the opposite 
direction thereby creating a bi-directional network processing system, wherein the leaming state 
machine and the second leaming state machine are able to share state information concerning related 
flows. 

3. (Original) The network processing system of Claim 1 wherein the leaming state machine 
identifies events and characteristics of each of the particular flows by comparing the contents of each 
of the particular flows to a database of known signatures, wherein a match with one of the known 
signatures corresponds to a certain event or characteristic. 
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4. (Original) The network processing system of Claim 3 wherein a treatment for each data 
packet is determined based on the results of the comparison with the database of known signatures. 

5. (Original) The network processing system of Claim 1 wherein the leaming state machine 
is able to examine the entire contents of each data packet and to maintain state across packet 
boundaries. 

6. (Original) The network processing system of Claim 3 wherein the database of known 
signatures is programmed at a separate server and downloaded into the network processing system in 
the form of an image file. 

7. (Original) The network processing system of Claim 6 wherein the events and 
characteristics leamed by the network processing system are compiled into statistics for the network. 

8. (Original) The network processing system of Claim 1 wherein the leaming state machine 
includes a header preprocessor for examining header information in the packet, a content processor 
for comparing the packet to the database and determining a treatment, and a quality of service 
processor for modifying the packet and directing the packet according to the treatment. 

9. (Original) The network processing system of Claim 8 wherein each leaming state 
machine further includes a microprocessor for data packets that require additional processing. 

10. (Original) A network processing system for use in a network, the network consisting of 
multiple flows each flow formed by multiple data packets, the network processing system 
comprising: 

at least one left line interface operable to receive data packets fi-om the network and to send 
processed data packets onto the network; 
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at least one right line interface operable to receive data packets from the network and to send 
processed data packets onto the network; 

a right learning state machine receiving data packets from the left interface, and sending 
processed data packets to the right line interface; and 

a left learning state machine receiving data packets from the right interface, and sending 
processed data packets to the left line interface; 

each of the right and left learning state machines fiirther comprising: 

a traffic flow processor processing the data packets to associate each data packet with a 
particular flow, to maintain state for each flow, and to compare one or more flows to a database of 
known signatures, such that a match with one or more signatures within the database of known 
signatures causes the network processing system to apply a treatment to the flow; 

a quality of service processor communicating with the traffic flow processor and receiving 
the treatment, such that the quality of service processor uses the treatment to determine the handling 
of the data packets and their associated flow. 

1 1 . (Original) The network processing system of Claim 1 0 wherein the handling of the data 
packets and their associated flow includes modifying the contents of the data packets. 

12. (Original) The network processing system of Claim 10 wherein the left and the right 
learning state machines exchange information concerning flows. 

13. (Original) The network processing system of Claim 10 wherein the traffic flow 
processor is comprised of a header preprocessor and a content processor, the header preprocessor 
operable to examine header information for each packet, and the content processor operable to 
compare the packet with the database of known signatures. 
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14. (Original) The network processing system of Claim 10 wherein the state includes 
information concerning the characteristics of the flow as well as a record of events contained in the 
flow. 

15. (Original) The network processing system of Claim 1 0 wherein the state existing for the 
particular flow at the time a new packet belonging to the particular flow is examined, is used in 
conjunction with the database to determine the treatment. 

16. (Original) The network processing system of Claim 10 wherein the database of known 
signatures is programmed using a management interface on a separate server and downloaded into 
the network processing system in the form of an image file. 

17. (Original) The network processing system of Claim 16 wherein the management 
interface also acts to retrieve statistical and event information from the network processing system. 
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